LAW FIRM INFORMATION GOVERNANCE SYMPOSIUM JULY 2014

HIPAA OMNIBUS

TASK FORCE REPORTJULY 2014

1 Background

3 Introduction

4 SectionI:ImportantDatesandGeneralApplication

oftheFinalHIPAAOmnibusRule

4 SectionII:BusinessAssociates

5 SectionIII:EnforcementandPenalties

7 SectionIV:PrivacyRequirements

9 SectionV:SecurityRequirements

10 SectionVI:BreachNotification

1 2 SectionVII:DataProtectionandPrivacyProgram

14 SectionVIII:RecommendedBestPractices

16 References

16 Authorities

18 Appendix:HIPAAOmnibusSecurityRuleComplianceTable

CONTENTS

1

BACKGROUND

TheLawFirmInformationGovernanceSymposiumwasestablishedin2012asaplatformforthelegalindustry

tocreatearoadmapforinformationgovernance(IG)intheuniquesettingoflawfirms.TheSymposiumoffers

definitions,processes,andbestpracticesforbuildinglawfirmIG.FirmscanleveragetheSymposiumcontentto

tailoranIGprogramthatworksfortheircultureandgoals.In2013,theSymposiumSteeringCommitteecreated

fourtaskforcestoworkonspecific,currentlawfirmIGtopics.ThisHIPAAOmnibusTaskForcereportsummarizes

andanalyzeskeycomponentsoftheHIPAAOmnibusRulethataffectlawfirms,andexploresindustrybest

practicesforachievingHIPAAcomplianceinalawfirmenvironment.

BRIANNE AUL

FirmwideRecordsSeniorManager

ReedSmith,LLP

BRYN BOWEN, CRM

Principal

GreenheartConsultingPartnersLLC

LEIGH ISAACS, CIP

DirectorofRecords

andInformationGovernance

Orrick,HerringtonandSutcliffeLLP

RUDY MOLIERE

DirectorofRecordsandInformation

Morgan,Lewis&BockiusLLP

CHARLENE WACENSKE

SeniorManagerFirmWideRecords

Morrison&FoersterLLP

CAROLYN CASEY, ESQ.

SeniorManager,LegalVertical

IronMountain

SYMPOSIUM STEERING COMMITTEE

2

BRIAN B. MCCAULEY, CRM, IGP

TASK FORCE LEADER

DirectorofInformationGovernance

McDermottWill&EmeryLLP

SCOTT CHRISTENSEN

DirectorofTechnologyandInformation

Security

EdwardsWildmanPalmerLLP

KATHRYN HUME

SeniorRiskManagementConsultant

Intapp

GRANT W. JAMES

Sr.ManagerKnowledgeManagement

TroutmanSandersLLP

SHARON KECK

DirectorofRiskandRecords

PolsinelliPC

ANN KILLILEA

Counsel

McDermottWill&EmeryLLP

FARON LYONS

AccountManager

AlfrescoSoftware,Inc.

RUDY MOLIERE

FirmDirector,Records&Information

Morgan,Lewis&BockiusLLP

LawFirmInformationGovernance

SymposiumSteeringCommittee

CHARLENE WACENSKE

SeniorManagerFirmwideRecords

Morrison&FoersterLLP

LawFirmInformationGovernance

SymposiumSteeringCommittee

2013/2014 HIPAA TASK FORCE

ANGELA AKPAPUNAM

WilmerCutlerPickeringHale

andDorrLLP

KAREN ALLEN

MorganLewis&BockiusLLP

BETH CHIAIESE

Foley&LardnerLLP

RICHARD CLARK

HaynesandBoone,LLP

ALLEN GEBHARDT

IndependentContractor

CHARLES KENNEDY

JonesDay

DEB RIFENBARK

StinsonLeonardStreetLLP

JENNIFER STAKES

LittlerMendelsonPC

BRETT WISE

OgletreeDeakins

SYMPOSIUM PARTICIPANTS

ThefollowingSymposiumParticipants,alongwith26taskforceauthors,offeredpeerreview

commentsonthedrafttaskforcereportatthe2014Symposium.

INTRODUCTION

TheU.S.2013HealthInformationPortabilityandAccountabilityAct(HIPAA1)OmnibusRule,2whichwentintoeffect

onMarch26,2013andmandatedcompliancebySeptember23,2013,finalizespreviousmultiplerevisionstothe

HIPAAregulationsthatdirectlyimpactlawfirms.Themostsignificantchangeisthevastlyexpandedscopeof

HIPAAenforcement.Previously,HIPAAregulationsappliedonlyto“coveredentities”—organizationslikehealthcare

providersandinsurers—anddidnotextendstatutoryliabilityforcompliancetotheir“businessassociates”,such

astheirlawfirms.In2009,theHealthInformationTechnologyforEconomicandClinicalHealth(HITECH)Actlaid

thegroundworkformultipleprovisionsaffectingbusinessassociatesthatarenowfullyenforced.Underthenew

OmnibusRule,bothbusinessassociatesandsubcontractorsofcoveredentitiesaredirectlyliableforviolations

oftheSecurityRuleandselectprovisionsofthePrivacyRule,includingtherequirementthattheuseanddisclosure

ofProtectedHealthInformation(PHI)belimitedtothe“minimumnecessary”foranintendedpurpose.

Especiallywhenconsideredalongsideemergingstatedataprivacyandsecuritylawsandtransitiverequirements

imposedonfirmsfromclientsinregulatedindustrieslikefinancialservices,theOmnibusRuleissignificantly

impactingthewaylawfirmsdevelopandimplementaculturefocusedonregulatorycompliance,clientdataprivacy,

andclientconfidentiality.ToachievecompliancewiththenewHIPAArules,manyfirmshavelittlechoicebutto

enhancetheirconfidentialitycontrolsandtoadoptmorestringentsecuritymeasurestopreventunauthorized

disclosureofanyinformationprotectedunderHIPAA’srules.

ThefollowingreportsummarizesandanalyzeskeycomponentsoftheHIPAAOmnibusRulesthataffectlawfirms

asHIPAAbusinessassociates,i.e.,intheirroleascustodiansofHIPAAprotectedhealthinformationonbehalf

oftheirclients.ThereportdoesnotprovideanexhaustiveoverviewoftheHIPAArulesastheyaffectcovered

entities,butfocusesmorenarrowlyonthoserequirementsofcoreconcernforlawfirms.Itshouldbenotedthat

lawfirmssponsoringgrouphealthplansfortheiremployeesmayqualifyasHIPAAcoveredentities,assuchfirms

shouldconsulttherulesinthefullapplicationtocoveredentities.

AfterpresentingtheelementsoftheHIPAAOmnibusRuleforwhichlawfirmbusinessassociatesareliable,the

reportoutlinestheframeworkforalawfirmenterprisedataprotectionprogramcomprehensiveenoughtosatisfy

themultipledataprivacyandsecurityrequirementsimposedbyHIPAA.Thereportconcludesbyrecommending

asetofindustrybestpracticesforachievingHIPAAcomplianceinalawfirmenvironment.

3

4

SECTION I: IMPORTANT DATES AND GENERAL APPLICATION OF THE FINAL

HIPAA OMNIBUS RULE

» January 25, 2013: TheFederalRegisterpublishedthefinalHIPAAOmnibusRule.

» March 26, 2013: HIPAAOmnibusRuleofficiallywentintoeffect.

» September 23, 2013: Compliancedeadlineforvirtuallyeveryprovisionofthenewrules,withtheexception

ofagraceperiodforupdatestoexistingbusinessassociateagreements.

» September 22, 2014: Finaldeadlineforupdatestobusinessassociateagreementstoaccommodatethe

changestotheHIPAAsecurity,privacy,andbreachnotificationrules.

SECTION II: BUSINESS ASSOCIATES

LAW FIRMS AS BUSINESS ASSOCIATES AND SUBCONTRACTORS

ThevastmajorityoflawfirmsareliableforcompliancewiththeHIPAAOmnibusRulebecausetheycanbeclassified

asHIPAAbusinessassociateswithrespecttoclientsthatqualifyascoveredentities,orwithrespecttothird-party

organizationsthatprocessHIPAA-protectedinformationonbehalfofacoveredentity.Previously,lawfirmswere

onlyclassifiedasbusinessassociatesliableforcompliancewithHIPAA/HITECHiftheyhadacontractinplacewith

acoveredentitydefiningthemassuchandstipulatingconditionsforhandlingPHI.PursuanttothenewOmnibus

Rule,lawfirmsnowqualifyasbusinessassociatesbydefinition,independentofwhethertheyaredefinedassuch

inabusinessassociateagreement.Indeed,thefinalruleexpandsthedefinitionofabusinessassociatetoinclude

allthoseentitiesthatcreate,receive,maintain,ortransmitPHIonbehalfofacoveredentity.Still,acorecompliance

requirementisthatfirmshaveabusinessassociateagreementinplacewithallcoveredentities.

IfthedefenseofaclientinamedicalmalpracticeclaimrequiresaccesstoPHI,thelawfirmwillqualifyasabusiness

associate,whileinformationprocuredfromaplaintiffviasubpoenadoesnotestablishthestatusofbusiness

associateandneednotbesubjecttothesameconstraints.Informationproducedinlitigationduringdiscoveryalso

doesnotestablishabusinessassociatestatus,sincethisinformationisnotprocuredvoluntarilyonbehalf

ofacoveredentityorganization,butmerelybroughtintoscopepursuanttocourtdiscoveryrulesandpractices.

Thisexpandeddefinitionbringscertainpreviouslyunaffectedorganizationsintothebusinessassociatefold,exposing

themtothesamecompliancerequirementsastheircoveredentitiesclients.OnMarch19,2014,forexample,the

DepartmentofHealthandHumanServices’(HHS)OfficeforCivilRights(OCR)announcedthatitwasitsintention

tosurveyupto1,200coveredentitiesandbusinessassociatestodeterminetheirsuitabilityforamorefulsome

complianceaudit.Auditscanresultinregulatoryfines,correctiveactionplans,andcivilmonetarypenalties.

Additionally,thescopeoftheOmnibusRuleextendsbeyondbusinessassociatestoimpactotherpeopleor

organizationsthatonlyprocessPHIindirectlyandhavenodirectrelationshiptocoveredentities.Suchentities,

referredtoassubcontractors,performfunctionsfororprovideservicestoabusinessassociate,butarenot

amemberofthebusinessassociate’sdirectworkforce.Forexample,ahostedserviceprovideroranexpertwitness

thatcomesintocontactwithPHIwouldqualifyasasubcontractor.Accordingtothenewrules,subcontractorsthat

create,receive,maintain,ortransmitPHIonbehalfofabusinessassociatenowarealsoconsideredasbusiness

associatesandaresubjecttothesamecomplianceobligations.

5

DIRECT LIABILITY

TheOmnibusRuleholdsbusinessassociatesdirectlyliableforthefollowingHIPAAprovisions:

» Impermissible uses and disclosures.

» Failure to provide breach notification to the covered entity.

» Failure to provide access to a copy of electronic PHI to the covered entity, the individual, or the individual’s

designee (whichever is specified in the business associate contract).

» Failure to disclose PHI where required by HHS to investigate or determine the business associate’s

compliance with HIPAA.

» Failure to provide an accounting of disclosures.

» Failure to comply with the applicable requirements of the security rule.

Inaddition,businessassociatesremaincontractuallyliableforotherrequirementsofthebusinessassociate

contract.Ofnote,theOmnibusRulemakesclearthatacoveredentityisnotrequiredtoenterintoacontractor

otherarrangementwithabusinessassociatethatisasubcontractor.Ifthebusinessassociatechoosestohirethe

subcontractordirectly,thenthebusinessassociateisresponsibletoensurethataHIPAA-compliantsubcontractor

agreementisexecuted.Lawfirmsthatactasbusinessassociatesshouldtakestepstoensuretheyareincompliance,

includingdraftingandexecutingbusinessassociateagreementswiththosesubcontractorsthatrisetothelevel.

TotheextentlawfirmsworkwithindependentcontractorconsultantsorotherswhowillhaveaccesstoPHIaspart

oftherepresentation;theyshouldensuretheyadheretotheHIPAAprivacyandsecurityrequirementsaswell.

SECTION III: ENFORCEMENT AND PENALTIES

TheOmnibusRulenotonlyincreasedthescopeofHIPAA/HITECHtorenderbusinessassociatesandtheir

subcontractorsdirectlyliableforcompliancewithHIPAArules,butalsomodifiedthestructureofpenaltiesfor

breachesofcompliance.Pursuanttotherevisions,penaltiescannowrangefrom$100to$50,000perviolation,

withmaximumpenaltiesforviolationsofthesameHIPAAprovisionof$1.5millionperyear[please see Table 1 below].

PenaltyamountsaredeterminedbytheseverityofabreachtoPHIandthelevelofliabilityattributedto

theresponsiblepartyliableforthebreach.Businessassociatesandsubcontractorsaredirectlyliablefortheir

violations.Coveredentities,inaddition,canbepenalizedforviolationsoccurringonthepremiseofaffiliated

businessassociatesandsubcontractors.

COMPLIANCE REVIEWS AND COMPLAINT INVESTIGATIONS

PriortotheOmnibusRule,HHS/OCRcouldchoosetodisregardsecuritybreachesandindividualcomplaints,

unlessthebreachwasdeemedsevereenoughtonecessitatereview.Underthenewrule,whena“preliminary

reviewofthefacts”suggestsaviolationdueto“willfulneglect”bythecoveredentityorbusinessassociate,HHS/

OCRisrequiredtoinvestigatecomplaintsandconductcompliancereviews.However,inlieuofconductingaformal

enforcementactiontoresolveanon-complianceissue,HHS/OCRmayelecttoresolvethematterinformally.

HHS/OCRmaygatheradditionalfactsandrelevantinformationthroughaninquiryprocesswiththecoveredentity

orbusinessassociatetodetermineresponsibilityandcauseafterbeingnotifiedofareportedbreachorafiled

complaint.OCRcompliancereviewsaremandatorywhenviolationsarecausedbywillfulneglectorsomeotherform

ofculpability.

6

LeonRodriguez,OCRDirectoratthetimeofthisreportpreparation(mid2014),mademultiplepublicstatements

warningbusinessassociatestoprepareforanincreaseinthenumberofformalinvestigationsandsettlementorders.

Thefocusonbusinessassociatesstemsfrombreachhistorypatterns—fromthe2009(afterHTECHpassed)to

201257%3ofreportedPHIbreachesoccurredinbusinessassociateenvironments.Lawfirmsshouldmakeprogress

oncomplianceinitiativestoavoidthesteeppenaltiesassociatedwithachargeof“willfulneglect.”

FINES

Collectiveresponsibilityforaviolationmaybeattributabletocoveredentities,businessassociates,and

subcontractors;consequentially,HHS/OCRmaydeterminethatallthreeshouldreceivefines.Finescanbecome

veryexpensive—veryquickly—becausetheyarecalculatedonaper-person-affected,per-day-effectivebasis,with

multiplefactorsfromdifferentpartsoftheoverallHIPAArulesconsideredtodefineandimposepenalties.OCRwill

imposehigherpenaltiestoviolationsoccurringafterFebruary18,2009,andretaintheformerpenaltystructure

forviolationsthatoccurredpriortothatdate.

DETERMINATION OF RESPONSIBILITY OR “STATE OF MIND”

POTENTIAL PENALTY PER VIOLATION

MAXIMUM ANNUAL CAP FOR ALL VIOLATIONS OF IDENTICAL HIPAA PROVISION

VIOLATION WAS NOT KNOWN AND

COULD NOT HAVE BEEN DISCOVERED

WITH REASONABLE DILIGENCE

$100 – $50,000 $1,500,000

REASONABLE CAUSE FOR VIOLATION,

NOT DUE TO WILLFUL NEGLECT

$1,000 – $50,000 $1,500,000

VIOLATION DUE TO WILLFUL NEGLECT,

BUT CORRECTED IN 30 DAYS

$10,000 – $50,000 $1,500,000

VIOLATION DUE TO WILLFUL NEGLECT,

NOT CORRECTED IN 30 DAYS

$50,000 $1,500,000

TABLE 1

Lawfirmsshouldbeawarethereisnosingleofficialmethodfortallyingmonetarypenalties,andtotalpenaltieswill

exceedthoseincurredpriortotheHITECHAct,whenfirmswereonlyliableforbreachofcontract.Whileapossible

penaltyof$1.5milliondollarsperprovisionmayseemlikeasteepfine,thegreatestriskacompliancebreachposes

toafirmisatarnishedreputationthatcouldcompromisefuturebusinessopportunitieswithclients.

7

SECTION IV: PRIVACY REQUIREMENTS

TheHIPAAOmnibusRulecomprisesthreeprinciplesubsectionsthatstipulatewhomayaccessPHI(thePrivacy

Rule),howelectronicPHIshouldbeprotectedtoensurethatonlythosewhoshouldhaveaccessactuallydo

(theSecurityRule),andwhatstepsorganizationsmusttakeintheeventthatsomeoneaccessesPHIwithout

authorization(theBreachNotificationRule).TheOmnibusRuleformalizedmultiplechangestoeachofthese

individualsubsectionstointensifyandclarifytheirscopeandapplication.Thisreportfocusesonthechanges

ofmostrelevanceforlawfirmbusinessassociates.

STRUCTURE OF THE HIPAA PRIVACY RULE

DataprivacyregulationsliketheHIPAAPrivacyRulesetstandardsforusesanddisclosuresofpersonallyidentifiable

information(PII),informationthatcanbeusedonitsownorwithotherinformationtoidentify,contact,orlocate

asinglepersonandpotentiallydoharmtothisindividual.ThePrivacyRuledefinestherightsthatindividualshave

todeterminehowothersusetheirpersonalhealthinformation.

Asisalwaysthecasewithaccesscontrolrightsandrestrictions,thechallengewiththeHIPAAPrivacyRuleisto

striketherightbalancebetweeninformationflowsrequiredforbusinessneedsandtheprotectionofindividual

privacyandconfidentiality.Todefineandachievethisbalance,HHSdefinesrequired,permitted,andauthorized

usesanddisclosuresofPHI,allgovernedbyanaccesscontrolprincipleknownasthe“minimumnecessarystandard.”

Fortunately,asbusinessassociates,lawfirmsareonlyliableforselectportionsofthePrivacyRule;theyshould

focuscomplianceeffortsonselectaspectsoftheoverallrulethataredirectlypertinenttothem.

DEFINITIONS OF USES AND DISCLOSURES

ThePrivacyRuleclassifiesusesanddisclosuresofPHIintothreecategories:required,permitted,andauthorized.

CoveredentitiesandbusinessassociatesarerequiredtoprovideaccesstoPHItothoseindividualswhoarethe

subjectofthedata(ortheirrepresentatives),whentheyrequestaccessoranaccountingofdisclosuresoftheir

PHI,andtoHHSwhenitundertakesacomplianceinvestigationorenforcementaction.

HIPAAaffectedorganizationsarepermittedtoprovideaccesstoPHIwithoutanindividual’sexplicitauthorizationfor

treatment,payment,andhealthcareoperations,aswellasforfacilitydirectoriesorforpublicinterestandbenefit

activities.Ofinteresttolawfirms,organizationsarepermittedtodisclosePHIasrequiredbylaw.Acourtorderor

protectiveordersignedbyajudgerequiresnofurtherassurancesornotificationstotheindividual,whereas

asubpoenaordiscoveryrequestsignedbyanattorneyrequireseithernoticetotheindividual,ordeclarationthat

reasonableeffortshavebeenmadetonotifytheindividualwithoutsuccess.

ThefollowingusesanddisclosuresofPHIrequireexplicitauthorizationbytheindividualwhoisthesubject

ofthedata:

» PHI sent to a life insurer for coverage purposes.

» PHI sent to an employer of results of pre-employment physical or lab test.

» PHI sent to a pharmaceutical firm for marketing purposes.

» PHI used for the marketing of an organization’s appointments, treatments, products or services.

» PHI used for sales involving remuneration in exchange for PHI, not in exchange for the services provided

where PHI is involved (e.g., a health information exchange).

PHIusedforfundraisingandresearchpurposesdonotrequireexplicitauthorization,althoughtheOmnibusRuledid

renderauthorizationstandardsmorestringentthanpreviously.

8

THE MINIMUM NECESSARY STANDARD

Underthenewrule,allusesanddisclosuresofPHIaregovernedbythe“minimumnecessary”standard,which

stipulatesthat“coveredentitiesandbusinessassociatesmustmakereasonableeffortstouse,disclose,andrequest

onlytheminimumamountofPHIneededtoaccomplishintendedpurposeofuse,disclosureorrequest.”Thismarks

asignificantshiftinthewayinwhichlawfirmsmanageclientinformation.Untilrecently,lawfirmshavegenerally

grantedinternallawyersandstaffaccesstomostinformationmaintainedwithinthefirm’ssystems,placingaccess

restrictionsonlyininstanceswhereethicalwallsorconfidentialitypoliciesweremandatedbytheconflictsand

imputationguidelinesofajurisdiction’sethicalrules.TocomplywithHIPAAandaccesscontrolrestrictionsmandated

byclientsinrequestsforproposals,outsidecounselguidelines,oron-siteinformationsecurityaudits,firmsmust

takeamorecontrolledapproach,onlygrantingaccesstohighlysensitiveinformationtothoselawyersandstaff

whorequireaccesstodotheirwork.

Whatqualifiesas“reasonable”efforts,ofcourse,variesfromfirmtofirmasafunctionofbusinessprocesses,costof

implementingaccesscontroltools,thequantityofPHIhousedwithinthefirm,andthedispersionofPHIacrossfirm

practicegroups.Forsomesmallerfirmswithlowerbudgets,a“reasonable”approachmaybesimplytohaveexternal

firewallsandencryption,stillgrantingaccesstomostofthefirmworkforce.Forlargerfirmswithhighertechnology

budgets,a“reasonable”approachwouldrequiresophisticatedmethodstoidentify,secure,andauditaccessforPHI,

restrictingaccesstolocalmatterteamsorpracticegroupswithhighPHIfootprints.

Manyfirmsmustmodifynotonlytheiraccesscontrolstrategies,butalsothemannerinwhichtheyrequestand

intakeinformationfromclients.ThePrivacyRulestipulatesthatbusinessassociatesshould“request”theminimum

amountofPHIrequiredforagivenpurpose.Firmsshould,therefore,considerprovidingengagementlettersto

coveredentityandbusinessassociateclientsthatexplicitlyrequestthattheclientrefrainfromsendinginformation

easilyidentifiedasnotnecessaryfortheengagement.

WHAT ASPECTS OF THE PRIVACY RULE SHOULD LAW FIRMS FOCUS ON?

Whendevelopingaprivacyprogram,firmsshouldfocuson:

» Reviewing all business associate agreements to understand and comply with access control restrictions.

» Limiting uses and disclosures of PHI 1) as required by a business associate agreement, or 2) as permitted or

required under HIPAA.

» Limiting permissible disclosures to the minimum necessary.

» Providing access to a covered entity, to an individual who is the subject of the PHI, or to HHS during an

investigation.

» Ensuring PHI is never sold.

» Establishing business associate agreements with relevant clients, subcontractors, hosted service providers,

expert witnesses, etc.

» Maintaining compliance records and submitting reports to HHS when required to evaluate compliance.

» Providing a breach notification to a covered entity within 60 days of a breach.

» Developing a program to communicate privacy requirements to affected lawyers and staff.

Asbusinessassociates,lawfirmsdonotofficiallyrequireanappointedprivacyofficeroranoticeofprivacypractices,

butmanyfirmsappointalawyerfamiliarwithHIPAA,ariskleader,orageneralcounseltomanageprivacyand

contractualrequirements.

9

SECTION V: SECURITY REQUIREMENTS

ThesecondsubsectionoftheHIPAARules,theSecurityRule,wascreatedtoprotecttheprivacyofindividuals’health

informationwhileallowingcoveredentitiesandtheirbusinessassociatestoadoptnewtechnologies.LikethePrivacy

Rule,itisdesignedtobeflexible,general,andscalable,allowingorganizationstoanalyzeandinterpretthemeansby

whichtheywillsatisfycompliancewiththe40unique“implementationspecifications”therulerequires.Unlikethe

PrivacyRule,itappliesonlytoelectronicPHI,asopposedtoPHIinanymedium(oral,paper,orelectronic).Originally

publishedin2003,therulecontainssomeanachronismsthatmustbeconsideredcautiouslygiventherapid

developmentsinavailabletechnologiesthathaveoccurredsincetheinitialpublication.

STRUCTURE OF THE HIPAA SECURITY RULE

AkintogeneralinformationsecurityframeworksliketheISO27001/27002frameworkortheNIST800-

53framework,theSecurityRuledefinesalistof40requiredandaddressablemeasuresforprotectingthe

confidentiality,integrity,andavailabilityofPHIthatisheldortransmittedbycoveredentitiesandtheirbusiness

associates.Themeasures,or“implementationspecifications,”areclassifiedintothreetypes:

»» Administrative»safeguards»refer to the processes and procedures covered entities and business associates

must address to understand their environment, assess risks to PHI, train workforce on requirements, and

develop disaster recovery and contingency plans.

»» Physical»safeguards refer to the tools and policies covered entities and business associates must have in

place to control security on workstations, facilities, and mobile devices.

»» Technical»safeguards»refer to the software and tools covered entities and business associates must have

in place to ensure the confidentiality, integrity, and availability of electronic PHI and to protect against

reasonably anticipated, impermissible uses or disclosures.

ThedefinitionstheSecurityRuleprovidesfor,confidentiality,integrity,andavailability,complementandsupplement

therequirementsofthePrivacyRule.“Confidentiality”meansthatelectronicPHI(ePHI)isnotavailableordisclosed

tounauthorizedpersons,supportingthePrivacyRule’sprohibitionsagainstimproperusesanddisclosuresofPHI.

“Integrity”meansthatePHIisnotalteredordestroyedinanunauthorizedmanner,toensurethatitisalways

availableandaccurateforindividuals.And“Availability”meansthatePHIisaccessibleandusableondemandby

anauthorizedperson,supportingrequireddisclosuresofthePrivacyRule.

COMPLIANCE WITH THE SECURITY RULE

Asbusinessassociates,lawfirmsareliableforcompliancewiththeentiretyoftheHIPAASecurityRule,which,

aswiththePrivacyRule,oftennecessitatesinvestmentandenergyinpoliciesandproceduresthatexceedtheir

standardinformationsecuritypractices.AswiththePrivacyRule,firmswilladdresstherequirementsoftheSecurity

Ruleinmyriadwaysdependingontheiravailabletechnologies,size,PHIfootprint,andtheoutcomeoftheirrisk

assessment.Variationalsoresultsfromthefactthatsomeimplementationspecificationsarerequiredandothers

areaddressable,meaningthattheorganizationcandocumentreasonsforeithersubstitutingadifferentcompliance

approachorabstainingfromcompliancealltogether.Requiredspecificationsincludeperformingariskanalysisto

identifyvulnerabilities,assigningresponsibilitytoaHIPAAsecurityofficer,oremployingaccesscontroltechnologies

torestrictaccessperuser,etc.Addressablespecificationsincludedevelopingaworkforceclearanceprocedure,

providingsecurityreminderstotheworkforce,orencryptingelectronicinformation.HHSiscurrentlyreassessing

theencryptionrequirementtoensurethatthestandardadequatelyaddressescurrentinformationflowsand

technologies.Foragoodchecklistofthesecurityrulerequirements,seeAppendix.

ToreducetheadministrationburdenofsecuringPHI,manyfirmsdeveloppoliciesrequiringthatlawyersandstaff

maintainandstorePHIonone,andonlyone,centralsystem,oftenthefirm’sdocumentmanagementsystemor

securefileshares.OftenthisrequiresachangemanagementefforttomigratePHIfromscatteredfilesharesto

10

asecureandstructuredenvironmentlikeadocumentmanagementsystem.Firmsfrequentlyidentifyincoming

PHIatnewmatterintakeandeducatelawyersandstafftofileandsecuredataaccordingtofirmpolicylaterinthe

matterlifecycle.ToaddresstherequirementtotrackaccesstoPHIbothinternallyandexternally,lawfirmbusiness

associatesincreasinglyusesoftwaretomonitorfor,andaddresssuspiciousactivity.Finally,firmsshouldconsider

investinginencryptionsoftwaretosafeguardPHItransferredbetweenorganizationsoraccessedviapersonal

mobiledevices.

AchievingcompliancewiththeSecurityRuleisnotaone-timeevent.Firmsshouldreviewandmodifytheirsystems

andprocessesregularlytoadaptprotectionsforePHItonewtechnologiesorotherenvironmentalchanges.Aspart

ofanongoingriskassessment,firmsshouldrevaluateriskstoePHI,trainincominglawyers,associatesandstaff,and

sendfrequentreminderstotheworkforcetokeeppoliciestopofmindandstayabreastofavailabletechnologies

toaddresstechnicalrequirements.Finally,thefirmshouldkeeplogsandrecordsoftheircomplianceefforts,

documentingmodificationsovertime.

SECTION VI: BREACH NOTIFICATION

ThethirdsubsectionoftheHIPAARulesistheBreachNotificationRule.The2009HITECHActcreatedthefirst

nationalrequirementfornotificationofsecuritybreacheswithrespecttoindividualhealthinformation,now

effectiveundertheOmnibusRule.TheBreachNotificationRulerequiresHIPAAcoveredentitiestoprovidecertain

notificationsinresponsetoabreachofunsecuredPHI.Inaddition,businessassociatesofcoveredentitieshave

anobligationtonotifycoveredentitiesintheeventthatanyofthecoveredentities’PHIinthebusinessassociate’s

possessionwassubjecttoabreach.

DEFINITION OF A BREACH

TheFinalRulerevisedthedefinitionofabreachofunsecuredPHItomakeitmoredifficultforacoveredentity,

orabusinessassociate,toavoidreportinganunauthorizeduseordisclosureofPHItoaffectedindividualsand

toOCR.Itreplacedtheharmthresholdstandardwithanew“rebuttablepresumption”standard.TheFinalRule

clarifiesthatanimpermissibleuse,ordisclosureofPHI,ispresumedtobeareportablebreachunlessthecovered

entityorbusinessassociatecandemonstratethatthereisa“lowprobability”thatthePHIhasbeencompromised.

Putanotherway,anunauthorizeduseordisclosurewouldnotqualifyasabreachofunsecuredPHIifthecovered

entityorbusinessassociatehasdemonstrated,pursuanttoabreachinvestigation,thatthereisalowprobability

thatthePHIhasbeencompromised,oriftheunauthorizeduseordisclosuredoesnotinvolveunsecuredPHI.

Typically,thelawfirmasaprovideroflegalservicestoitscoveredentityclientsqualifiesasabusinessassociateif

itreceivestheclient’sPHI.Atleasttwoitemsdictatethelawfirm’sresponsibilitiesifPHIiscompromised:(1)HIPAA

anditsregulations;and(2)theBusinessAssociateAgreementbetweentheclient/coveredentityandthelawfirm.

BothrequirecomplianceinmanagingasecurityincidentaffectingPHI.

UnderHIPAA,thelawfirmmustdeterminewhetherunsecuredPHIisinvolvedintheincident.PHIis“unsecured”ifit

failstoberenderedunusable,unreadable,orindecipherabletounauthorizedpersonsthroughtheuseoftechnology

ormethodologyspecifiedbytheSecretaryofHHS.PHIwillonlybedeemed“secured”ifitisencryptedordestroyed

inaccordancewiththeguidancereferencedbyHHSandpublishedbytheNationalInstituteofStandardsand

Technology(NIST).OneoftheinitialquestionsthatthelawfirmshouldaskinitsinvestigationiswhetherthePHI

isencryptedaccordingtoNISTstandards.Ifyes,thentheevent,basedonHIPAAaloneandnootherconsiderations,

isnotareportablebreachofunsecuredPHI.

Thelawfirmmustthendeterminewhethertheincidentqualifiesasabreach.Abreachmeanstheunauthorized

acquisition,access,useofdisclosureofPHI,whichcompromisesthesecurityorprivacyoftheunsecuredPHIand

thatisnotexcludedfromthedefinitionofreachsetforthintheapplicableregulations.

11

THE FOUR-FACTOR RISK ASSESSMENT

IfitisdeterminedthattheinformationinvolvedinabreachisunsecuredPHIandnoapplicableexceptionsapply,

thenthelawfirmmustconductariskassessmenttodeterminewhetherthereis“alowprobabilitythatthePHIhas

beencompromised.”TheFinalRuleprovidesfourfactorstobeconsideredtodeterminewhetherthePHIhasbeen

compromised:

» The nature and extent of the PHI involved, including the types of identifiers and the likelihood of

re-identification. For example, risk increases when sensitive financial information, such as credit card

numbers or social security numbers are involved, or if the potential breach involves sensitive medical

information.

» The identity of the unauthorized person who used the PHI or to whom the disclosure was made. If the

recipient is another covered entity, business associate, or covered under other privacy laws, the risk

is decreased.

» Whether the PHI was actually acquired or viewed. For example, if a laptop is lost or stolen but later

recovered, and a forensic analysis shows that the PHI was never accessed, the risk is lessened.

» The extent to which the risk to the PHI has been mitigated. For example, the covered entity may mitigate

risk by having the recipient sign a confidentiality agreement that the PHI will be destroyed or will not

be further used or disclosed.

ThelawfirmmustevaluatetheoverallprobabilitythatthePHIhasbeencompromisedbyconsideringeachone

ofthesefourfactors,andotherfactorsasdeemedappropriate.HHSemphasizessuchriskassessmentsmustbe

thoroughandcompletedingoodfaith,andtheconclusionsreachedmustbereasonable.Ifanevaluationofthese

factorsfailstodemonstratethatthereisalowprobabilitythatthePHIhasbeencompromised,thelawfirmis

requiredtonotifytheclient/coveredentity,whichinturnmayberequiredtonotifytheaffectedindividuals

and/orOCR.

Tosummarize,lawfirmbusinessassociatesarenowsubjecttodirectregulationandenforcementoftheBreach

NotificationRule,andshouldtakeheedoftheirregulatoryobligationsforinvestigatingandreportingofbreaches

ofunsecuredPHI.Asabusinessassociate,lawfirmswillhavetheburdenofprooftodemonstratethattheyhave

providedtheclient/coveredentitywithrequirednotifications,orthattheimpermissibleuseordisclosuredidnot

constituteareportablebreach.Lawfirmsmust,therefore,maintaindocumentationasnecessarytomeetthis

burdenofproof.

12

SECTION VII: DATA PROTECTION AND PRIVACY PROGRAM

Breachesanddatalossincidentshavebecomeafactoflifeforfirmsofeverysize.Nooneisimmunefromtheloss

ofsensitiveandconfidentialdata.Asbusinessesamasslargerquantitiesofdiversifieddataonarangeofdevices,

includingconsumerinformation,employeerecords,businesspartnerandproprietarydata,everyonemustbe

preparedfortheinevitableloss.Thealarminggrowthindataincidentsandcybercrimehighlightsthechallenges

thatallbusinessleadersface.

Whilemanyfirmsmaybeawareofthethreat,theyarenotnecessarilyequippedtorespondeffectively,ormistakenly

thinkitwillnothappentothem.Compoundingthismisguidedsenseofsecurityisthemindsetthatcybersecurity

isanITissue.Viewingbreachesasatechnicalissueisarecipeforfailureversusrecognizingthateverydepartment

withinanorganizationneedstoplayaroleinreadinessplanning.Firmsmustacknowledgetheenterprise-wide

disruptionthatcanoccurwhenadatabreachisdiscovered.Thosethatprepareinadvancewillnotonlybein

positiontosurvivethedatabreach,butretaintheirgoodreputationintheeyesoftheirclients,partners,and

employees.Implementationofaneffectivedataprotectionandprivacyprogramisaninherentstepinaddressing

theseimportantissues.

DATA LIFECYCLE MANAGEMENT & STEWARDSHIP

Thelegalindustryadvocatesfortheneedtocreateadatalifecyclestrategyandincidentresponseplan,evaluating

datafromacquisitionthroughuse,storage,anddestruction.Akeytosuccessfuldatalifecyclemanagement

isbalancingregulatoryrequirementswithbusinessneedsandclientexpectations.

DATA GOVERNANCE AND LOSS PREVENTION

Alawfirm’sresponsibilityfordatagovernanceisdynamicandinaconstantstateofmodification.Policyand

proceduredevelopmentalongwithestablishingrolesandresponsibilitiesisakeycomponentofthegovernance

dependency.Thelevelofresponsibilityvariesnotonlybetweencountriesbutalsobetweenstates.

INCIDENT RESPONSE PLANNING

Lawfirmsmustbepreparedtoreactonseveralfrontswhenconfrontedwithadatalossincidentorbreach.

Tobeprepared,itiscriticaltohaveanorchestratedresponseplanwithrelationshipswithkeyvendorsandlaw

enforcementinplace.Awell-documentedprojectplanisonlyasgoodasthetrainingandreadinessofthe

incidentteam.Incidentresponseplanningshouldinclude:

» Creation of an incident response team (please see Illustration 1 below)

» Creation of a project plan

» Determination of incident notification requirements

» Creation of appropriate responses

» Providing assistance & possible remedies

13

INCIDENT RESPONSE TEAM

LAW ENFORCEMENT

OUTSIDE LEGAL

FORENSICS

EXECUTIVETEAM

HUMANRESOURCES

CARDASSOCIATIONS

INFORMATION TECHNOLOGYSECURITY

RISKMANAGEMENTCOMPLIANCE

PUBLICRELATIONS

Firm GeneralCounsel

TRAINING, TESTING AND BUDGET

Adataprotectionandprivacyplanwillultimatelyfailtobeexecutediftheattorneysandemployeeschargedwith

itsadministrationarenotadequatelytrained.Lawfirmsmusthavetheforesighttoallocatestafftimeandbudgetfor

thepropertrainingandexecutionoftheirdataprotectionplan.Inorderforaprogramtobesuccessful,itiscritical

thattheplanbereviewedbykeystakeholders,befullytested,andupdatedregularly(considerquarterly)toaddress

changesinthecompanyorinthethreatlandscape.

Factorstoconsiderinthisareainclude:

» Employee awareness and readiness training

» Analysis of the legal implications

» Funding and budgeting

» Critique and after action analysis

Dataprotectionandprivacyalongwithafirm’spreparednessforadatalossincidentaresignificantissuesevery

stakeholdermustrecognize.Thisriskhasbeenelevatedbyseveralfactorsincludingtheregularcollectionofvast

amountsofdigitalinformationandtheincreasinglevelsofcybercrime,geo-locationapplications,andonlinemalice.

Combinedwiththeexplosivegrowthofbigdata,mobiledevices,andincreasedrelianceofcloudserviceproviders,

itisvitalthatfirmleadersfocusondatastewardshipasakeyfirmpriorityandresponsibility.Failuretodosoputs

clientsandthefirminharm’swayunnecessarily,addingtotheregulatoryandlegalrisk.

ILLUSTRATION 1

14

SECTION VIII: RECOMMENDED BEST PRACTICES

Developing,implementing,andmaintainingasatisfactoryHIPAAcomplianceprograminalawfirmenvironment

isadauntingtaskforallinformationgovernanceprofessionals.Itisimportantthatfirmsadheretobestpractices

andapproachcompliancegradually,makingheadwaywhenpossibletoavoidthepenaltiesassociatedwith“willful

neglect”whiledocumentingalong-termcomplianceplanthattestifiestoconsciousandconcertedeffort.

InaccordancewiththeprecedingoverviewoftheHIPAAOmnibusrequirements,werecommendthefollowing

bestpractices:

» Assign a designated HIPAA security officer and, if applicable, privacy officer responsible for the firm’s

HIPAA compliance program. If identified as necessary, seek external assistance to help develop, implement,

and monitor the firm’s HIPAA compliance efforts.

» Inventory all existing business associate agreements with client covered entities and business associates.

Modify agreements as required to accommodate the revised requirements of the Omnibus Rule before

September 22, 2014.

» Develop and implement a centralized process for drafting, reviewing, and executing new business associate

agreements going forward. Execute business associate agreements where required with downstream HIPAA

subcontractors.

» Perform the risk assessment required by the HIPAA Security Rule to identify areas that require remediation

to achieve compliance.

» In conjunction with the implementation of, and compliance with good data asset protection policies,

firm-wide training, and auditing procedures, the firm should inventory systems where PHI is created,

maintained, stored or transmitted. This can be achieved by using tools like data loss prevention (DLP)

software and predictive coding/classification technologies.

» Identify information that contains PHI by executing a manual keyword search and classification of

unstructured content performed by relevant custodians i.e., attorneys and staff. Further, designate PHI

content in its profile properties form within structured environments like a document management system.

This can be as simple as adding a metadata field called “PHI.” Begin with active matters to make short-term

progress and proceed to information maintained on behalf of former clients.

» Designate a repository to maintain PHI and implement appropriate technologies to secure, monitor, and

encrypt PHI handled by the firm in accordance with access control standards and requirements. Mandatory

encryption of PHI should be standard operating procedure whenever it is stored outside of a protective

perimeter (or firewall), and during transmission/transport through unsecured channels (portable media).

» Develop, implement, and document the firm’s approach to handling PHI in accordance with the minimum

necessary standard of the Privacy Rule going forward. Modify and document new business intake procedures

and processes to include mandatory engagement letters that stipulate the firm’s requirements for requesting

and receiving PHI from clients. Include questions on intake forms to identify and flag HIPAA-related matters

so appropriate security measures can be applied.

15

» Educate affected lawyers and staff about the HIPAA requirements; their responsibilities for identifying and

securing client PHI, their responsibilities for identifying potential business associate relationships with

expert witnesses and other downstream contractors, and the firm’s finalized protocol for securing PHI in

its environment.

» Develop and implement policies and procedures that operationalize the HIPAA-related requirements

for determining whether a reportable breach of unsecured PHI has occurred. These written policies and

procedures should account for non-HIPAA mandated requirements that may govern the same incident, such

as applicable U.S. state data breach notification laws, business associate agreements with clients, and ethical

and contractual obligations.

» Develop procedures to identify business associate agreements between the law firm and the client/covered

entity that require the firm to report security incidents more quickly than is required by HIPAA itself, and

may even require that the firm report suspected breaches of unsecured PHI to the client/covered entity.

16

REFERENCES

1. 45 CFR Parts 160, 162, 164; U.S. Department of Health and Human Services Office for Civil Rights HIPAA

Administrative Simplification

2. U.S. Department of Health & Human Services

http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/index.html

3. Protected Health Information (PHI), pg. 10, February 2014, Redspin

4. IHS, Federal Health Program for American Indians and Alaska Natives. and put in this url

http://www.ihs.gov/hipaa/documents/ihs_hipaa_security_checklist.pdf

AUTHORITIES

HIPAA Minimum Necessary Standard Should be Key Component of Policies and Procedures, Now More than Ever;

Duane Morris, February 2013, Hart, Elinor and Clark, Lisa.

http://www.duanemorris.com/alerts/HIPAA_minimum_necessary_standard_should_be_key_component_policies_

and_procedures_4743.html

A Comprehensive Summary of the Final Omnibus HIPAA/HITECH Rules: Key Provisions and What They Mean

for You; Poyner Spruill, 2013, Johnson, Elizabeth.

http://www.poynerspruill.com/publications/Pages/summaryofNewHIPAARules.aspx

New Omnibus Rule Released: HIPAA Puts on More Weight; Davis Wreight Tremaine, January 2013, Williams,

Rebecca, Greene, Adam, Barash, Louisa, Eckels, Jane, Rauzi, Edwin, Thurber, Kent, and Blanchette, Kristen.

http://www.dwt.com/new-omnibus-rule-released-hipaa-puts-on-more-weight-01-23-2013/

18

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Administrative Safeguards

164.308(a)(1)(i)

SecurityManagementProcess:Implementpoliciesand

procedurestoprevent,detect,contain,andcorrect

securityviolations.

164.308(a)(1)(ii)(A)HasaRiskAnalysisbeencompletedinaccordancewith

IAWNISTGuidelines?(R)

164.308(a)(1)(ii)(B)HastheRiskManagementprocessbeencompletedin

accordancewithIAWNISTGuidelines?(R)

164.308(a)(1)(ii)(C)

Doyouhaveformalsanctionsagainstemployeeswho

failtocomplywithsecuritypoliciesandprocedures?

(R)

164.308(a)(1)(ii)(D)

Haveyouimplementedprocedurestoregularlyreview

recordsofISactivitysuchasauditlogs,accessreports,

andsecurityincidenttracking?(R)

164.308(a)(2)

AssignedSecurityResponsibility:Identifythesecurity

officialwhoisresponsibleforthedevelopmentand

implementationofthepoliciesandproceduresrequired

bythissubpartfortheentity.

164.308(a)(3)(i)

WorkforceSecurity:Implementpoliciesandprocedures

toensurethatallmembersofitsworkforcehave

appropriateaccesstoePHI,asprovidedunder

paragraph(a)(4)ofthissection,andtopreventthose

workforcememberswhodonothaveaccessunder

paragraph(a)(4)ofthissectionfromobtainingaccess

toelectronicprotectedhealthinformation(ePHI).

164.308(a)(3)(ii)(A)

Haveyouimplementedproceduresforthe

authorizationand/orsupervisionofemployeeswho

workwithePHIorinlocationswhereitmightbe

accessed?(A)

164.308(a)(3)(ii)(B)Haveyouimplementedprocedurestodeterminethat

theAccessofanemployeetoePHIisappropriate?(A)

APPENDIX

HIPAA OMNIBUS SECURITY RULE COMPLIANCE CHECKLIST

TheTaskForcefoundthebelowtablecreatedbytheIndianHealthService(IHS)4,theFederalHealthProgramfor

AmericanIndiansandAlaskaNatives,tobeanexcellentsummaryofthetheaddressableandrequiredactionsto

complywiththeNISTstandardfortheHIPAAOmnibusSecurityRule.

19

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Administrative Safeguards

164.308(a)(3)(ii)(C)

Haveyouimplementedproceduresforterminating

accesstoePHIwhenanemployeeleavesyour

organizationorasrequiredbyparagraph(a)(3)(ii)(B)

ofthissection?(A)

164.308(a)(4)(i)

InformationAccessManagement:Implementpolicies

andproceduresforauthorizingaccesstoePHIthatare

consistentwiththeapplicablerequirementsofsubpart

Eofthispart.

164.308(a)(4)(ii)(A)

Ifyouareaclearinghousethatispartofalarger

organization,haveyouimplementedpolicies

andprocedurestoprotectePHIfromthelarger

organization?(A)

164.308(a)(4)(ii)(B)

Haveyouimplementedpoliciesandproceduresfor

grantingaccesstoePHI,forexample,throughaccessto

aworkstation,transaction,program,orprocess?(A)

164.308(a)(4)(ii)(C)

Haveyouimplementedpoliciesandproceduresthat

arebaseduponyouraccessauthorizationpolicies,

established,document,review,andmodifyauser’s

rightofaccesstoaworkstation,transaction,program,

orprocess?(A)

164.308(a)(5)(i)

SecurityAwarenessandTraining:Implementasecurity

awarenessandtrainingprogramforallmembersofits

workforce(includingmanagement).

164.308(a)(5)(ii)(A)Doyouprovideperiodicinformationsecurity

reminders?(A)

164.308(a)(5)(ii)(B)

Doyouhavepoliciesandproceduresforguarding

against,detecting,andreportingmalicioussoftware?

(A)

164.308(a)(5)(ii)(C)Doyouhaveproceduresformonitoringloginattempts

andreportingdiscrepancies?(A)

164.308(a)(5)(ii)(D)Doyouhaveproceduresforcreating,changing,and

safeguardingpasswords?(A)

164.308(a)(6)(i)SecurityIncidentProcedures:Implementpoliciesand

procedurestoaddresssecurityincidents.

164.308(a)(6)(ii)

Doyouhaveprocedurestoidentifyandrespondto

suspectedorknowsecurityincidents;mitigatetothe

extentpracticable,harmfuleffectsofknownsecurity

incidents;anddocumentincidentsandtheiroutcomes?

(R)

20

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Administrative Safeguards

164.308(a)(7)(i)

ContingencyPlan:Establish(andimplementas

needed)policiesandproceduresforrespondingto

anemergencyorotheroccurrence(forexample,fire,

vandalism,systemfailure,andnaturaldisaster)that

damagessystemsthatcontainePHI.

164.308(a)(7)(ii)(A)

Haveyouestablishedandimplementedproceduresto

createandmaintainretrievableexactcopiesofePHI?

(R)

164.308(a)(7)(ii)(B)

Haveyouestablished(andimplementedasneeded)

procedurestorestoreanylossofePHIdatathatis

storedelectronically?(R)

164.308(a)(7)(ii)(C)

Haveyouestablished(andimplementedasneeded)

procedurestoenablecontinuationofcriticalbusiness

processesandforprotectionofePHIwhileoperatingin

theemergencymode?(R)

164.308(a)(7)(ii)(E)

Haveyouassessedtherelativecriticalityofspecific

applicationsanddatainsupportofothercontingency

plancomponents?(A)

164.308(a)(8)

Haveyouestablishedaplanforperiodictechnical

andnon-technicalevaluation,basedinitiallyupon

thestandardsimplementedunderthisruleand

subsequently,inresponsetoenvironmentalor

operationalchangesaffectingthesecurityofePHI

thatestablishestheextenttowhichanentity’ssecurity

policiesandproceduresmeettherequirementsofthis

subpart?(R)

164.308(b)(1)

BusinessAssociateContractsandOtherArrangements:

Acoveredentity,inaccordancewithSec.164.306,may

permitabusinessassociatetocreate,receive,maintain,

ortransmitePHIonthecoveredentity’sbehalfonly

ofthecoveredentityobtainssatisfactoryassurances,

inaccordancewithSec.164.314(a)thatthebusiness

associateappropriatelysafeguardtheinformation.

164.308(b)(4)

Haveyouestablishedwrittencontractsorother

arrangementswithyourtradingpartnersthat

documentssatisfactoryassurancesrequiredby

paragraph(b)(1)ofthissectionthatmeetsthe

applicablerequirementsofSec.164.314(a)?(R)

21

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Physical Safeguards

164.310(a)(1)

FacilityAccessControls:Implementpoliciesand

procedurestolimitphysicalaccesstoitselectronic

informationsystemsandthefacilityorfacilitiesin

whichtheyarehoused,whileensuringthatproperly

authorizedaccessisallowed.

164.310(a)(2)(i)

Haveyouestablished(andimplementedasneeded)

proceduresthatallowfacilityaccessinsupportof

restorationoflostdataunderthedisasterrecovery

planandemergencymodeoperationsplanintheevent

ofanemergency?(A)

164.310(a)(2)(ii)

Haveyouimplementedpoliciesandproceduresto

safeguardthefacilityandtheequipmentthereinfrom

unauthorizedphysicalaccess,tampering,andtheft?

(A)

164.310(a)(2)(iii)

Haveyouimplementedprocedurestocontroland

validateaperson’saccesstofacilitiesbasedontheir

roleorfunction,includingvisitorcontrol,andcontrolof

accesstosoftwareprogramsfortestingandrevision?

(A)

164.310(a)(2)(iv)

Haveyouimplementedpoliciesandproceduresto

documentrepairsandmodificationstothephysical

componentsofafacility,whicharerelatedtosecurity

(forexample,hardware,walls,doors,andlocks)?(A)

164.310(b)

Haveyouimplementedpoliciesandproceduresthat

specifytheproperfunctionstobeperformed,the

mannerinwhichthosefunctionsaretobeperformed,

andthephysicalattributesofthesurroundingsofa

specificworkstationorclassofworkstationthatcan

accessePHI?(R)

164.310(c)

Haveyouimplementedphysicalsafeguardsforall

workstationsthataccessePHItorestrictaccessto

authorizedusers?(R)

164.310(d)(1)

DeviceandMediaControls:Implementpoliciesand

proceduresthatgovernthereceiptandremovalof

hardwareandelectronicmediathatcontainePHIinto

andoutofafacility,andthemovementoftheseitems

withinthefacility.

164.310(d)(2)(i)

Haveyouimplementedpoliciesandproceduresto

addressfinaldispositionofePHI,and/orhardwareor

electronicmediaonwhichitisstored?(R)

22

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Physical Safeguards

164.310(d)(2)(ii)

HaveyouimplementedproceduresforremovalofePHI

fromelectronicmediabeforethemediaareavailable

forreuse?(R)

164.310(d)(2)(iii)

Doyoumaintainarecordofthemovementsof

hardwareandelectronicmediaandtheperson

responsibleforitsmovement?(A)

164.310(d)(2)(iv)Doyoucreatearetrievable,exactcopyofePHI,when

needed,beforemovementofequipment?(A)

Technical Safeguards

164.312(a)(1)

AccessControls:Implementtechnicalpoliciesand

proceduresforelectronicinformationsystemsthat

maintainePHItoallowaccessonlytothosepersons

orsoftwareprogramsthathavebeengrantedaccess

rightsasspecifiedinSec.164.308(a)(4).

164.312(a)(2)(i)Haveyouassignedauniquenameand/ornumberfor

identifyingandtrackinguseridentity?(R)

164.312(a)(2)(ii)

Haveyouestablished(andimplementedasneeded)

proceduresforobtainingnecessaryePHIduringand

emergency?(R)

164.312(a)(2)(iii)

Haveyouimplementedproceduresthatterminate

anelectronicsessionafterapredeterminedtimeof

inactivity?(A)

164.312(a)(2)(iv)Haveyouimplementedamechanismtoencryptand

decryptePHI?(A)

164.312(b)

HaveyouimplementedAuditControls,hardware,

software,and/orproceduralmechanismsthatrecord

andexamineactivityininformationsystemsthat

containoruseePHI?(R)

164.312(c)(1)Integrity:Implementpoliciesandprocedurestoprotect

ePHIfromimproperalterationordestruction.

164.312(c)(2)

Haveyouimplementedelectronicmechanisms

tocorroboratethatePHIhasnotbeenalteredor

destroyedinanunauthorizedmanner?(A)

164.312(d)

HaveyouimplementedPersonorEntityAuthentication

procedurestoverifythatapersonorentityseeking

accessePHIistheoneclaimed?(R)

23

HIPAA SECURITY RULE

REFERENCE

SAFEGUARD

(R) = REQUIRED, (A) = ADDRESSABLE

STATUS COMPLETE,

N/A

Technical Safeguards

164.312(e)(1)

TransmissionSecurity:Implementtechnicalsecurity

measurestoguardagainstunauthorizedaccessto

ePHIthatisbeingtransmittedoveranelectronic

communicationsnetwork.

164.312(e)(2)(i)

Haveyouimplementedsecuritymeasurestoensure

thatelectronicallytransmittedePHIisnotimproperly

modifiedwithoutdetectionuntildisposal?(A)

164.312(e)(2)(ii)HaveyouimplementedamechanismtoencryptePHI

wheneverdeemedappropriate?(A)

US-LAW-EXT-BR-082014-014

ABOUT IRON MOUNTAINIronMountainIncorporated(NYSE:IRM)providesinformationmanagementservicesthathelporganizationslowerthecosts,risksandinefficienciesofmanagingtheirphysicalanddigitaldata.Foundedin1951,IronMountainmanagesbillionsofinformationassets,includingbackupandarchivaldata,electronicrecords,documentimaging,businessrecords,secureshredding,andmore,fororganizationsaroundtheworld.Visitthecompanywebsiteatwww.ironmountain.comformoreinformation.

©2014IronMountainIncorporated.Allrightsreserved.IronMountainandthedesignofthemountainareregisteredtrademarksofIronMountainIncorporatedintheU.S.andothercountries.Allothertrademarksarethepropertyoftheirrespectiveowners.